Preserve active leases and align flow recovery rounds

Local review candidate only. Explicitly selected inherited prerequisites and prior repair patches; unrelated WIP and independent MQ fixes are excluded. No push or deployment authorized.

src/test/java/com/yunhai/svchall/service/impl/ServiceApplyFlowSubmitTest.java

@@ -299,4 +299,26 @@ class ServiceApplyFlowSubmitTest {
         assertEquals(ApplyFlowStatusEnum.REJECTED.getCode(), apply.getFlowStatus().intValue(),
                 "出站失败保持原态，可再次重提");
     }
+    @Test
+    void productionResubmitUsesCommandContractWithoutBlindApprovingWrite() {
+        apply.setFlowStatus(30); apply.setFcIntentId(1);
+        when(applyRepository.findByIdAndSchId(42, 1L)).thenReturn(Optional.of(apply));
+        FlowApplyRecoveryService commands = mock(FlowApplyRecoveryService.class);
+        service.setFlowCommandsForTest(commands);
+        service.resubmit(user(9, 1), 42);
+        verify(commands).requestExecution(42, true);
+        verify(flowClient, never()).apply(anyLong(), anyString(), anyString(), anyString(), anyString(), any(), any(), anyInt(), anyString(), any());
+        verify(applyRepository, never()).markResubmitted(anyInt(), anyLong(), any());
+        assertEquals(30, apply.getFlowStatus().intValue());
+    }
+
+    @Test
+    void guardedApplyCannotFallBackToLegacyWhenCommandServiceMissing() {
+        apply.setFlowStatus(30); apply.setFcIntentId(1);
+        when(applyRepository.findByIdAndSchId(42, 1L)).thenReturn(Optional.of(apply));
+        assertThrows(BizException.class, () -> service.resubmit(user(9, 1), 42));
+        verify(flowClient, never()).apply(anyLong(), anyString(), anyString(), anyString(), anyString(), any(), any(), anyInt(), anyString(), any());
+        assertEquals(30, apply.getFlowStatus().intValue());
+    }
+
 }